We tell you when something you are running has a known vulnerability. You decide when to apply the update.
That split is deliberate rather than us stepping back. A plugin update can break a live site, and you are the only party who can test that your booking form, your forms and your integrations still work afterwards. Applying it blind on your behalf is how a Tuesday morning goes wrong.
If you would rather someone managed that for you, we are happy to recommend people who do it well.
